+++
title = "CVE-2026-3682-1"
path = "/CVE-2026-3682-1"
description = """\
  CVE-2026-3682-1: Unauthenticated Podcast Injection in htmx allowing remote exposure to extended Carson Gross \
  monologues, Grug Brained Developer content, and unsolicited Fixi.js advocacy via a single CSV commit."""
[extra]
show_title = false
+++

<style>
  body { background: #fff; }
  header.top-nav { display: none; }
  body > footer { display: none; }
  main.content { max-width: none; }
  .cve-page {
    font-family: Arial, Helvetica, sans-serif;
    max-width: 760px;
    margin: 0 auto;
    color: #1c1c1c;
    line-height: 1.5;
  }
  .cve-page .hvcc-header {
    background: linear-gradient(180deg, #003366 0%, #002244 100%);
    color: #fff;
    padding: 14px 20px;
    margin: 0 -10px 24px -10px;
    border-bottom: 4px solid #b30000;
    display: flex;
    align-items: center;
    justify-content: space-between;
  }
  .cve-page .hvcc-header .hvcc-brand {
    font-weight: bold;
    font-size: 14px;
    letter-spacing: 0.6px;
    text-transform: uppercase;
  }
  .cve-page .hvcc-header .hvcc-brand small {
    display: block;
    font-weight: normal;
    font-size: 11px;
    color: #cfd8e3;
    letter-spacing: 0.3px;
    text-transform: none;
    margin-top: 2px;
  }
  .cve-page .hvcc-header .hvcc-id {
    font-family: "Courier New", Courier, monospace;
    font-size: 15px;
    background: #b30000;
    padding: 4px 10px;
    border-radius: 2px;
  }
  .cve-page h1 {
    font-size: 26px;
    margin: 0 0 6px 0;
    color: #003366;
  }
  .cve-page h2 {
    font-size: 16px;
    background: #003366;
    color: #fff;
    padding: 6px 12px;
    margin: 28px 0 0 0;
    border-radius: 2px 2px 0 0;
    text-transform: uppercase;
    letter-spacing: 0.5px;
  }
  .cve-page .section-body {
    border: 1px solid #d0d7de;
    border-top: none;
    padding: 14px 16px;
    background: #fcfcfc;
    border-radius: 0 0 2px 2px;
  }
  .cve-page .severity-bar {
    display: flex;
    gap: 10px;
    flex-wrap: wrap;
    margin: 10px 0 18px 0;
  }
  .cve-page .severity-bar .badge {
    display: inline-block;
    padding: 6px 12px;
    border-radius: 3px;
    font-size: 13px;
    font-weight: bold;
    letter-spacing: 0.4px;
  }
  .cve-page .badge-critical { background: #b30000; color: #fff; }
  .cve-page .badge-score    { background: #1c1c1c; color: #fff; }
  .cve-page .badge-status   { background: #006633; color: #fff; }
  .cve-page .badge-published{ background: #e8eef5; color: #003366; border: 1px solid #b8c4d4; }
  .cve-page table.advisory {
    width: 100%;
    border-collapse: collapse;
    margin: 8px 0;
    font-size: 14px;
  }
  .cve-page table.advisory th,
  .cve-page table.advisory td {
    border: 1px solid #d0d7de;
    padding: 8px 10px;
    text-align: left;
    vertical-align: top;
  }
  .cve-page table.advisory th {
    background: #e8eef5;
    color: #003366;
    width: 28%;
    font-weight: bold;
  }
  .cve-page table.timeline {
    width: 100%;
    border-collapse: collapse;
    font-size: 14px;
  }
  .cve-page table.timeline th,
  .cve-page table.timeline td {
    border: 1px solid #d0d7de;
    padding: 8px 10px;
    text-align: left;
    vertical-align: top;
  }
  .cve-page table.timeline th {
    background: #003366;
    color: #fff;
  }
  .cve-page table.timeline td.dt {
    font-family: "Courier New", Courier, monospace;
    white-space: nowrap;
    width: 22%;
    color: #555;
  }
  .cve-page .cvss-vector {
    font-family: "Courier New", Courier, monospace;
    background: #f1f3f5;
    padding: 2px 6px;
    border: 1px solid #d0d7de;
    border-radius: 2px;
    font-size: 12px;
    word-break: break-all;
  }
  .cve-page .notice {
    background: #fff8dc;
    border-left: 4px solid #d4a017;
    padding: 10px 14px;
    margin: 14px 0;
    font-size: 14px;
  }
  .cve-page .danger {
    background: #fdecea;
    border-left: 4px solid #b30000;
    padding: 10px 14px;
    margin: 14px 0;
    font-size: 14px;
  }
  .cve-page .metabar {
    display: grid;
    grid-template-columns: repeat(4, 1fr);
    gap: 1px;
    background: #d0d7de;
    border: 1px solid #d0d7de;
    margin: 12px 0 18px 0;
    font-size: 13px;
  }
  .cve-page .metabar > div {
    background: #fff;
    padding: 8px 10px;
  }
  .cve-page .metabar .label {
    color: #666;
    font-size: 11px;
    text-transform: uppercase;
    letter-spacing: 0.5px;
    display: block;
    margin-bottom: 2px;
  }
  .cve-page footer.advisory-footer {
    margin-top: 36px;
    font-size: 11px;
    color: #666;
    border-top: 1px solid #d0d7de;
    padding-top: 12px;
    line-height: 1.5;
  }
  @media (max-width: 720px) {
    .cve-page .metabar { grid-template-columns: repeat(2, 1fr); }
  }
</style>

<div class="cve-page">

<div class="hvcc-header">
  <div class="hvcc-brand">
    Hypermedia Vulnerability Coordination Center
    <small>National Hypermedia Vulnerability Database (NHVD)</small>
  </div>
  <div class="hvcc-id">CVE-2026-3682-1</div>
</div>

# Unauthenticated Podcast Injection in bigskysoftware/htmx

<div class="severity-bar">
  <span class="badge badge-critical">SEVERITY: CRITICAL</span>
  <span class="badge badge-score">CVSS 3.1: 9.8</span>
  <span class="badge badge-status">STATUS: REMEDIATED</span>
  <span class="badge badge-published">PUBLISHED: 2026-04-01</span>
</div>

<div class="metabar">
  <div><span class="label">CVE ID</span>CVE-2026-3682-1</div>
  <div><span class="label">Assigner</span>HVCC (unofficial)</div>
  <div><span class="label">Last Modified</span>2026-04-01</div>
  <div><span class="label">Vector</span>AV:N / UI:R</div>
</div>

## Description

<div class="section-body">

An issue was discovered in **bigskysoftware/htmx** via [PR #3682](https://github.com/bigskysoftware/htmx/pull/3682). An interviewer with podcast-level access was able to inject three (3) bad YouTube links into `www/content/talk/podcasts.csv`, allowing a remote, unauthenticated listener to be exposed in a single sitting to:

- *Hypermedia TV - An interview with Carson Gross*
- *Hypermedia TV - The Grug Brained Developer*
- *Hypermedia TV - Fixi Vs. Htmx*

Successful exploitation may result in the victim thinking that using htmx or fixi is a reasonable idea, potentiall deleting `node_modules` on aesthetic grounds, and/or telling a coworker "actually, that's not REST."

</div>

## Severity Metrics

<div class="section-body">

<table class="advisory">
  <tr><th>Base Score</th><td><strong>9.8 (Critical)</strong></td></tr>
  <tr><th>CVSS 3.1 Vector</th><td><span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H/E:H/RL:O/RC:C</span></td></tr>
  <tr><th>Attack Vector</th><td>Network (YouTube embed / RSS / link in CSV)</td></tr>
  <tr><th>Attack Complexity</th><td>Low - the link is right there</td></tr>
  <tr><th>Privileges Required</th><td>None</td></tr>
  <tr><th>User Interaction</th><td>Required - victim must press play</td></tr>
  <tr><th>Scope</th><td>Changed - affects the victim's relationship with HTML</td></tr>
  <tr><th>Confidentiality</th><td>Low (build secrets safe; worldview exfiltrated)</td></tr>
  <tr><th>Integrity</th><td>High (opinions modified at runtime)</td></tr>
  <tr><th>Availability</th><td>High (entire weekend rendered unavailable)</td></tr>
</table>

</div>

## Weakness Enumeration (CWE)

<div class="section-body">

<table class="advisory">
  <tr><th>CWE-1188</th><td>Insecure Default Initialization of Developer Opinions</td></tr>
  <tr><th>CWE-200</th><td>Exposure of Sensitive Information (specifically: that Single Page Applications may have been a mistake)</td></tr>
  <tr><th>CWE-444</th><td>Inconsistent Interpretation of HTTP Requests ("REST" vs. REST)</td></tr>
  <tr><th>CWE-829</th><td>Inclusion of Functionality from Untrusted Control Sphere (YouTube)</td></tr>
</table>

</div>

## Affected Products

<div class="section-body">

<table class="advisory">
  <tr><th>Vendor</th><td>bigskysoftware</td></tr>
  <tr><th>Product</th><td>htmx</td></tr>
  <tr><th>Affected Versions</th><td>All versions of <code>htmx.org</code> serving <code>/talk/</code> between PR #3682 merge and the remediation commit</td></tr>
  <tr><th>Affected File</th><td><code>www/content/talk/podcasts.csv</code></td></tr>
  <tr><th>Patched Versions</th><td>Current master (post-remediation commit)</td></tr>
</table>

</div>

## Disclosure Timeline

<div class="section-body">

<table class="timeline">
  <tr><th>Date / Time (UTC)</th><th>Event</th></tr>
  <tr>
    <td class="dt">2026-03-14 - T-18d</td>
    <td>Initial reconnaissance. Threat actor identifies <code>podcasts.csv</code> as an unauthenticated append target with no schema validation, no entropy checks, and no opinion-content filtering.</td>
  </tr>
  <tr>
    <td class="dt">2026-03-28 - T-04d</td>
    <td>Weaponization. Three YouTube assets staged under the channel name "Hypermedia TV." Payloads cover three independent attack surfaces: Carson Gross interview, Grug Brained Developer commentary, and a Fixi-vs-htmx framing comparison.</td>
  </tr>
  <tr>
    <td class="dt">2026-04-01 - T+0</td>
    <td>Delivery. PR <a href="https://github.com/bigskysoftware/htmx/pull/3682">#3682</a> opened against <code>master</code> by author <code>tonsoflaz2</code>, titled "Added 3 links to the podcast channel." Description states the links are "all my own interviews with carson gross."</td>
  </tr>
  <tr>
    <td class="dt">2026-04-01 - T+2h</td>
    <td>PR merged without security review. Three Hypermedia TV entries land on production <code>htmx.org/talk/</code>.</td>
  </tr>
  <tr>
    <td class="dt">2026-04-01 - T+6h</td>
    <td>First confirmed exploitation in the wild: external listener reportedly converts to hypermedia within 40 minutes of pressing play.</td>
  </tr>
  <tr>
    <td class="dt">2026-04-01 - T+11h</td>
    <td>Public disclosure on Hacker News under the headline "Show HN: I rewrote my SaaS in htmx after watching one YouTube video." Thread reaches the front page.</td>
  </tr>
  <tr>
    <td class="dt">2026-04-01 - T+14h</td>
    <td>HVCC opens advisory CVE-2026-3682-1.</td>
  </tr>
  <tr>
    <td class="dt">2026-04-01 - T+20h</td>
    <td>Remediation commit lands on <code>master</code> removing all three Hypermedia TV entries from <code>www/content/talk/podcasts.csv</code>.</td>
  </tr>
  <tr>
    <td class="dt">2026-04-01 - T+22h</td>
    <td>Public advisory published at <code>htmx.org/CVE-2026-3682-1</code>.</td>
  </tr>
  <tr>
    <td class="dt">2026-04-02 - T+1d</td>
    <td>Status set to <strong>REMEDIATED</strong>. Threat actor <code>tonsoflaz2</code> permanently banned from the repository (see Future Prevention).</td>
  </tr>
</table>

</div>

## Remediation

<div class="section-body">

There is no patched version of htmx itself, as the vulnerability lies in the website content layer. The following remediation has been applied **upstream** and is reflected in the current contents of [`www/content/talk/podcasts.csv`](https://github.com/bigskysoftware/htmx/blob/master/www/content/talk/podcasts.csv):

- All three (3) "Hypermedia TV" entries introduced by PR #3682 have been **removed** from `podcasts.csv`.
- The remediation is included in **this push**.

End users who visited `htmx.org/talk/` during the exposure window (2026-04-01 00:00 UTC through 2026-04-01 20:00 UTC) are advised to apply the following client-side mitigations, in order of escalation:

1. **Immediately clear browser history**, including autocomplete, cookies, IndexedDB, and any cached `<video>` thumbnails depicting a man at a whiteboard.
2. **Revoke any YouTube "watch later" entries** added during the exposure window.
3. **Purge all downloaded transcripts.** `grep -rli "hypermedia" ~ | xargs rm` is provided as a starting point but is not exhaustive.
4. **In severe cases, wipe the affected hard drive** and reinstall from a known-good backup taken prior to 2023.
5. **For human victims who personally watched the offending podcasts**, application of *eye bleach* is recommended. Approved formulations include:
   - One (1) episode of any Vercel keynote
   - Thirty (30) minutes of TypeScript generics documentation
   - A single uninterrupted viewing of a `webpack.config.js` belonging to a stranger
6. **Do not, under any circumstances, attempt to rewrite your frontend in htmx as a coping mechanism.** This is the intended outcome of the attack.

<div class="danger">
<strong>WARNING:</strong> Restoring from a pre-2023 backup will recover most affected systems, but cannot undo conversations had with coworkers, blog posts published, or conference talks submitted during the exposure window. Those artifacts must be addressed individually.
</div>

</div>

## Future Prevention

<div class="section-body">

To prevent recurrence, the following controls have been implemented:

1. **The threat actor `tonsoflaz2` has been permanently banned** from the `bigskysoftware/htmx` repository. We note for the record that the threat actor is personally known to and on cordial terms with the maintainer; this relationship was given no weight in the decision. The ban applies regardless. We will, however, continue to invite him to dinner.
2. **All future modifications to `podcasts.csv` require dual maintainer approval** and a written attestation that the linked content does not contain the phrase "locality of behavior."
3. **A pre-merge CI check** has been added to scan incoming `podcasts.csv` diffs for known indicators of compromise (channels named "Hypermedia TV," "Plain HTML Daily," "<em>just</em> use the form").
4. **Rate limiting** has been imposed on podcast additions per author per calendar quarter, with a hard ceiling of one (1) self-interview per twelve (12) months.
5. **A Hypermedia Threat Intelligence (HTI) feed** is being established to share indicators of compromise with the broader hypermedia community, including the Hypermedia Systems book, hyperscript.org, and Big Sky Software downstream consumers.

</div>

## Workarounds

<div class="section-body">

For users unable to apply the remediation immediately:

- Block `*.youtube.com` at the firewall.
- Disable CSV parsing in your local copy of the htmx website.
- Switch careers.

</div>

## References

<div class="section-body">

- [https://github.com/bigskysoftware/htmx/pull/3682](https://github.com/bigskysoftware/htmx/pull/3682) - original injection vector (MERGED, now remediated upstream)
- [https://github.com/bigskysoftware/htmx/blob/master/www/content/talk/podcasts.csv](https://github.com/bigskysoftware/htmx/blob/master/www/content/talk/podcasts.csv) - current (post-remediation) state of the affected file
- [https://htmx.org/talk/](https://htmx.org/talk/) - list of known-exposed surfaces
- [https://htmx.org/essays/](https://htmx.org/essays/) - secondary infection vector (text-based)

</div>

## Credits

<div class="section-body">

Reported by the PR author against themselves. Triage, CVSS scoring, and timeline reconstruction performed by the Hypermedia Vulnerability Coordination Center (HVCC). Eye-bleach formulations courtesy of the Frontend Industrial Complex. Permanent ban issued by the maintainer with regret but without exception.

</div>

<footer class="advisory-footer">
This advisory is published for informational and recreational purposes. The "Hypermedia Vulnerability Coordination Center" and the "National Hypermedia Vulnerability Database" are not real, are not affiliated with MITRE, NIST, or any CVE Numbering Authority, and have not assigned a real CVE identifier. CVE-2026-3682-1 is an unofficial joke identifier and must not appear in any vulnerability scanner, SBOM, GHSA, or compliance report. If it does, that is itself a vulnerability and you should file a bug against your tooling.
</footer>

</div>